instar 1.3.981 → 1.3.983

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.981",
+  "version": "1.3.983",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-26T04:54:53.613Z",
-  "instarVersion": "1.3.981",
+  "generatedAt": "2026-07-26T07:12:22.087Z",
+  "instarVersion": "1.3.983",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.982.md

@@ -0,0 +1,84 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**A behavioural commitment was marked `verified` or `violated` according to whether its
+optional `behavioralRule` field was populated — 98 of 98 rows, no exceptions.**
+
+`CommitmentTracker.verifyBehavioral` decided the verdict with
+`content.includes(commitment.id)` against the behavioural rules file. That file is written
+**by the same class** from its own active list, and nothing else on the machine reads it, so
+the check verified that the system had written its own file and reported the result as a
+verdict on the promise.
+
+Measured on the live store: **74 behavioural commitments with `behavioralRule` set all read
+`verified`; 24 without it all read `violated`.** Because the sweep runs about once a minute,
+each accumulated a tick per pass — CMT-068 reached **162,344 violations**, and four
+commitments created in the same minute held **identical** counts (80,425), which individual
+conduct cannot produce.
+
+Behavioural commitments now take the path this file already gives an unverifiable
+`one-time-action`: **the sweep is a no-op**, the promise stays `pending`, and closure remains
+explicit (`deliver()` / `markDelivered()` / `expiresAt`), with the overdue surfacing keeping
+it visible. Both wrong answers are removed, not just one — `verified` was false comfort and
+`violated` a false accusation, since a blank optional field is not a broken promise.
+
+`getHealth` changed with it. It previously reported `"N commitment(s) tracked, all verified"`
+whenever nothing was marked broken, inferring compliance from the absence of violations —
+which would have become a *new* false claim once these rows moved to `pending`. It now names
+how many are genuinely verified and how many are not automatically verifiable. It also stops
+reporting the component `degraded`, which those 24 false violations had made permanent.
+
+The rules file still self-heals when missing (now `ensureBehavioralRulesFile`, which returns
+nothing) — repairing bookkeeping is worth doing but is not evidence about a promise.
+
+**What this does not do:** behavioural compliance remains unverified by anything. This stops
+the system claiming otherwise; it does not build real verification, which would require
+observing conduct against each rule. `config-change` verification is untouched and still
+genuinely reads live state.
+
+## What to Tell Your User
+
+If you track commitments, promises about behaviour now show as **pending** rather than
+verified or violated, with both counters at zero. That is more honest, not a regression:
+nothing was ever watching whether those promises were kept, so "verified" was reassurance
+nobody had earned and "violated" was usually just a blank optional field.
+
+You may also notice the commitment health line stops saying "all verified" and stops
+reporting itself degraded. Both were consequences of the same defect.
+
+## Summary of New Capabilities
+
+- A promise that cannot be automatically checked reports as open instead of being declared
+  kept or broken, matching the treatment this module already gave unverifiable one-time
+  actions.
+- Commitment counters no longer accumulate a tick per sweep for behavioural promises.
+- The commitment health line distinguishes "verified" from "not automatically verifiable"
+  rather than inferring compliance from an absence of violations.
+
+## Evidence
+
+**Reproduction (before):** record a behavioural commitment and run the verify sweep 25
+times. With `behavioralRule` set: `status: 'verified'`, `verificationCount: 25`. Without it:
+`status: 'violated'`, `violationCount: 25`, detail `"Missing behavioralRule on behavioral
+commitment"`. Live store corroboration: 74/74 with the field `verified`, 24/24 without it
+`violated`; CMT-068 at 162,344; CMT-555/556/557/558 identical at 80,425.
+
+**Observed after,** same scenarios against the built code:
+
+| scenario | before | after (25 sweeps) |
+|---|---|---|
+| behavioural, `behavioralRule` set | `verified`, +1 tick per sweep | `pending`, verifications 0, violations 0 |
+| behavioural, field absent | `violated`, +1 tick per sweep | `pending`, verifications 0, violations 0 |
+| rules file deleted | produced a verdict | no verdict; file self-heals; status unchanged |
+| health, 1 behavioural row | `"1 commitment(s) tracked, all verified"` | `"1 commitment(s) tracked — 0 verified, 1 not automatically verifiable (no violations)"`, status `healthy` |
+
+**Tests:** `tests/unit/CommitmentTracker.test.ts` — three tests rewritten because they
+asserted the removed behaviour (one of them asserting that a *missing* optional field is a
+broken promise; another named `"detects violation when rules file is deleted"` whose body
+asserted the opposite, with a comment conceding it). Two regression guards added: 25 sweeps
+accumulate zero ticks on either shape of behavioural promise, and health never claims "all
+verified" over promises it has not observed. **79 tests pass**; `npx tsc --noEmit` clean.

package/upgrades/1.3.983.md

@@ -0,0 +1,108 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**A project item could read `merged` while carrying no record of what merged it — and
+the two regression detectors that read that record were therefore selecting nothing and
+reporting all clear.**
+
+`/projects/:id/advance` proves four things before it will move an item to `merged`: the
+PR state is `MERGED`, it has a format-valid merge commit sha, that sha is reachable from
+canonical main, and the CI rollup is green. It then persisted **only** `pipelineStage`
+and discarded the evidence. Measured on the live store: both Tier-1 children of the
+`convergence-towards-coherence` project read `pipelineStage: "merged"` with no
+`prNumber`, no `mergeCommitOid` and no `ciCheckedAt`.
+
+The cause was a type, not carelessness. `StageTransitionResult`'s success case was
+`{ ok: true }` — one bit — while every refusal carried `reason` + `code`. The validator
+explained itself when it said no and said nothing when it said yes, so the caller had
+nothing to write down. A passing verdict now carries a `MergedEvidence` record (PR
+number, merge sha, the canonical-main ref it was actually proven against, and an ISO
+timestamp), persisted in the **same** `update()` as the stage — so no window exists in
+which an item reads `merged` with nothing behind it.
+
+**The half that mattered more.** Two merged-state reconcilers find their candidates by
+looking for `mergeCommitOid`: the lazy reconciler on `GET /projects/:id` (documented
+"may mutate", running on every read) and `verifyMergedItemsViaGit`. Nothing ever wrote
+that field, so the candidate set was always empty and the git verification never ran.
+A regression detector that scans nothing and reports nothing is indistinguishable from
+one that scans everything and finds nothing wrong — so merged work that was later
+reverted or force-pushed off main would never have been noticed.
+
+Because that path had never executed, three defects sat in it unexercised, **all three
+already fixed in the advance path a few hundred lines away**: it called
+`SafeGitExecutor.run` without `sourceTreeReadOk`, so SourceTreeGuard refuses the read
+against an instar source tree; it hardcoded `origin/main`, which on a dev-agent home is
+the agent's fork rather than where merges land; and its `catch {}` meant the caller
+marked the item `regressed`, turning "I could not check" into "it was reverted". Any one
+of those would have produced false demotions the moment evidence started being written,
+so both halves ship together. `verifyMergedItemsViaGit` now returns three states —
+`verified`, `regressed` (git's documented exit 1, the only genuine negative) and
+`unverifiable` (everything else, with its reason) — and the reconciler demotes only on
+`regressed`; an unverifiable item keeps its stage and takes only the `ciCheckedAt`
+backoff, so the question is asked again later instead of answered wrongly now.
+
+**What this does not do:** it adds no new regression checking. It makes the existing
+reconcilers *possible*, by giving them the evidence they were written to read, and
+*safe*, by stopping them guessing. Items merged before this change carry no evidence and
+report honestly as `unverifiable` with the reason "no mergeCommitOid recorded on the
+item" — no backfill is attempted, because reconstructing which PR merged a historical
+item would mean fabricating evidence.
+
+## What to Tell Your User
+
+If you use project tracking, a finished item now records the pull request, the commit
+and the time it was checked — so "merged" can name what merged it. Previously it could
+not.
+
+More usefully: the checks that watch for finished work being undone were, in practice,
+examining an empty list and reporting no problems. They now have something to examine.
+And when one of them cannot answer — no permission, wrong branch, missing commit — it
+says so instead of declaring the work reverted, which is what it used to do.
+
+## Summary of New Capabilities
+
+- A passing stage-transition verdict carries the evidence it established, instead of a
+  bare success flag.
+- A merged item records its PR number, merge commit and check timestamp in the same
+  write as its stage.
+- The merged-state verifier distinguishes "reverted" from "could not check", and the
+  reconciler demotes only on the former.
+- The reconciler checks the canonical-main ref resolved for the install rather than
+  assuming `origin/main`, so a fork-origin agent home no longer reads every healthy item
+  as regressed.
+- `POST /projects/:id/advance` echoes the recorded evidence back, so a caller can confirm
+  it landed rather than trusting that it did.
+
+## Evidence
+
+**Reproduction (before):** read any merged child of a project —
+`GET /projects/convergence-towards-coherence` returned both Tier-1 children with
+`pipelineStage: "merged"` and an object whose keys contained no `prNumber`,
+`mergeCommitOid` or `ciCheckedAt`. `grep` for writers of `mergeCommitOid` found none
+outside `InitiativeTracker`'s own accessors, while two consumers select on it.
+
+**Observed after,** same scenarios against the built code:
+
+| scenario | before | after |
+|---|---|---|
+| passing `building → merged` verdict | `{ ok: true }` | carries `prNumber`, `mergeCommitOid`, `mergeBaseBranch`, `verifiedAt` |
+| the item record after a merged advance | stage only | stage + PR number + merge sha + check timestamp, one write |
+| verifier, git exit 0 | verified | verified |
+| verifier, git exit 1 | not verified → caller demotes | `regressed` → caller demotes |
+| verifier, git exit 128 / guard refusal | not verified → **caller demotes** | `unverifiable` with reason → **stage unchanged** |
+| verifier, child with no recorded evidence | silently skipped | `unverifiable`, "no mergeCommitOid recorded" |
+| verifier's branch | hardcoded `origin/main` | the caller-resolved canonical-main ref |
+
+**Tests:** `tests/unit/merged-record-carries-its-evidence.test.ts` (9 new) plus 2 added
+to `tests/unit/StageTransitionValidator.test.ts`. All 9 fail against pre-fix source with
+failures that name the defect — "expected undefined to be defined" for the evidence-free
+approval, "prNumber must be persisted alongside the stage, not discarded after
+validation: expected false to be true", "the verifier readSync must exist: expected +0
+to be 1" (it used `.run`, proving the missing source-tree declaration), and "an item is
+demoted only when git said exit 1, never merely because it was absent from `verified`".
+The 48 pre-existing validator tests and the 8 `ProjectRoundExecution` tests pass
+unchanged. `npx tsc --noEmit` clean.